ShadowTalk: Powered by ReliaQuest

In this episode of ShadowTalk, host Chris, along with Rick and Kim, discuss the latest news in cyber security and threat research.  Topics this week include:

• ALPHV targeted in law enforcement operation
• A look back at major events from the previous 12 months
• Predictions for the cyber threat landscape in 2024
• 'Expense in depth' and maximising investments

Resources:

• https://www.reliaquest.com/blog/double-extortion-attack-analysis/
• https://www.reliaquest.com/blog/alphv-ransomware-site-outage/ 
• https://www.justice.gov/media/1329536/dl?inline=&utm_medium=email&utm_source=govdelivery

In this episode of ShadowTalk, host Corey Carter, along with ReliaQuest CISO Rick Holland and Gjergji Paco, discuss the latest news in cyber security and threat research.  Topics this week include:

• An overview of a ReliaQuest report on a sophisticated incident involving a technique known as Bring Your Own Vulnerable Driver (BYOVD).
• ALPHV ransomware site outage rumored to be caused by law enforcement.
• Apps vulnerable to Log4Shell still being exploited by Advanced Persistence Threats.
• FBI releases policy notice that informs cyber victims how they can request to delay public disclosures to the Securities and Exchange Commission.

Resources:

• https://www.sonatype.com/resources/log4j-vulnerability-resource-center
• https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/
• https://www.reliaquest.com/blog/alphv-ransomware-site-outage/
• https://www.fbi.gov/file-repository/fbi-policy-notice-120623.pdf/view
• https://www.kovrr.com/blog-post/cybersecurity-legal-and-financial-experts-share-their-reactions-to-the-secs-latest-cyber-disclosure-regulations

In this episode of ShadowTalk, host Chris, along with Caroline and James, discuss the latest news in cyber security and threat research. Topics this week include:

• Ransomware groups increasingly targeting ESXi
• Cyber Threats to the Airline industry
• Incidents affecting CNI in the US, UK, and Israel

Resources:

• https://www.gov.uk/government/news/response-to-a-news-report-on-cyber-security-at-sellafield
• https://www.cshub.com/attacks/news/lockbit-hackers-publish-43gb-of-stolen-boeing-data-following-cyber-attack
• https://www.theregister.com/2023/11/29/water_authority_ciso_iran/
• https://www.bleepingcomputer.com/news/security/linux-version-of-qilin-ransomware-focuses-on-vmware-esxi/

In this episode of ShadowTalk, host Corey, along with Rick, Marken, and James, discuss the latest news in cyber security and threat research. 
 Topics this week include:

• An overview of ReliaQuest's latest report covering EDR Pitfalls and Best Practices.
• Latest updates to Okta's Support Case Management System intrusion that occurred in October.
• Discussion on guidelines released for secure AI system development by CISA and UK NCSC.
• Infostealers making headlines after allegedly being able to restore expired Google cookies.

Resources:

Okta's Support Case Management System Intrusion Update-
https://sec.okta.com/harfiles

Proactive Defense: Positioning your IR Team for Success webinar-
https://event.on24.com/wcc/r/4388361/F9C6D55AEEB34F33683F29973F48D174?partnerref=shadowtalk

 CISA and UK NCSC Joint Guidelines-
https://www.cisa.gov/news-events/alerts/2023/11/26/cisa-and-uk-ncsc-unveil-joint-guidelines-secure-ai-system-development

 Scattered Spider Blog-
https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

In this episode of ShadowTalk, host Ivan, along with Brandon and Colin discuss the latest news in cyber security and threat research. Topics this week include:

• AlphaV filing a complaint with the SEC
• ReliaQuest case study on the Scattered Spider attack
• Sandworm hacker group conducts "largest ever" attack on Danish infrastructure

Resources:

• https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

In this episode of ShadowTalk, host Chris, along with Kim, discuss the latest news in cyber security and threat research. Topics this week include:

• CitrixBleed vulnerability mass targeted by threat actors
• Taking the burden from incidents responders by taking proactive steps
• Hacktivists targeting Israeli organizations with "BiBi" data wiping malware

Resources:

https://www.reliaquest.com/blog/citrix-bleed-vulnerability-background-and-recommendations/

In this episode of ShadowTalk, host Ivan Righi, along with ReliaQuest's CISO Rick Holland and Detection Researcher Marken Teder, discuss the latest news in cyber security and threat research. Topics this week include:

• Apache ActiveMQ vulnerability (CVE-2023-46604) exploited by ransomware gangs
• Discussion over charges filed by the US SEC against SolarWinds
• Active exploitation of a Critical Atlassian Confluence flaw (CVE-2023-22518)
• An overview of QR code phishing threats

Resources:

• https://event.on24.com/wcc/r/4387339/A63BC17298406ECD68AABFFEF416702B?partnerref=organic

In this episode of ShadowTalk, host Kim, along with Caroline and Corey, discuss the latest news in cyber security and threat research. Topics this week include:

• The charges filed by the US SEC against SolarWinds
• A sneak-peak of the findings from our Vulnerabilities Roundup blog
• An overview of some vulnerabilities impacting users right now
• The Executive Order issued by the Biden administration on artificial intelligence.

In this episode of ShadowTalk, Host Chris Morgan is joined by one of ReliaQuest's CISO's Rick Holland, Threat Hunter Brian Kelly and Threat Intelligence Analyst Ivan Righi to discuss the latest news in cyber security and threat research. Topics this week include:

• The findings of ReliaQuest's Quarterly Ransomware Report recapping Q3 2023 activity.
•  ServiceNow vulnerability and what it means for you
• The latest on a security incident pertaining to authentication provider, Okta.

Resources:

• https://www.reliaquest.com/blog/ransomware-trends-q3-2023/

In this episode of ShadowTalk, host Chris, along with Kim and Gjergji, discuss the latest news in cyber security and threat research. Topics this week include:

• Threat actors exploiting Critical CISCO IOS XE Vuln 
• Increase in Business Email Compromise (BEC) activity
• Social media platform Discord being used for malicious activity